3 ms·

So NAT is virtuous because it (in effect) expands the address space and makes address assignment (partly) dynamic (because the above-32-bit address components a

by pc2g4d 9y ago

So NAT is virtuous because it (in effect) expands the address space and makes address assignment (partly) dynamic (because the above-32-bit address components are assigned at connection time). But I think the article is ignorant of the real problems that NAT traversal cause in many situations. Yes, we have a system that largely works. But that in itself doesn't prove the current system is equivalent to the IPv6 alternative. In fact, there are good reasons to believe an IPv6 world will make the Internet significantly more dynamic and peer-to-peer friendly.

gerdesj 9y ago
Try putting in multiple internet connections each with its own IPv6 space! I have five at work but cannot really afford PI addressing (say £3000 per year) and certainly would not be able to get the four FTTC (VDSL) ISPs to route it. I also have a 100Mb leased line with yet another /56 prefix. That's five of the bloody things. Each PC/server/printer/whatever now has at least five globally unique IPv6 addresses. Now most of those devices also want to do various versions of each prefix - an algorithmic ally derived on based on MAC address, a randomish one (for privacy) etc. Add in link local and perhaps a few DHCPv6 addresses for good measure and it rapidly gets quite complicated. Now how does that lot get to and from the internet? For a PC to get to a web server it has to use the correct "local" address to get to the other end via the relevant ISP connection. However the PC can't know which internet connections are working without some form of routing protocol telling it what is going on upstream. So all my PCs, servers, printers and even IP cameras need to be routers rather than simply having a default gateway! As you can probably guess, that is not what I will actually do when I flick the IPv6 switch for real at work (home has been dual stack with one link for several years now). My current plan is ULA (a bit like IPv4 RFC 1918 - 192.168., 172.16. 10.) with Network Prefix Translation. That way my DNS servers, AD DCs (I think of those merely as KDCs but apparently they do other jobs) and other handy things wont renumber themselves every time a link goes down. The real joy of all this is I'll also get to manage two lots of firewall rules per VLAN. Can you imagine how busy a DNS server would get in the event of a flapping internet connection if it had to do dynamic DNS updates? Don't get hung up over NAT, the world of fully tooled up IPv6 is going to be far more "interesting", especially when you are not a big institution with a huge budget but want a bit more connectivity than one ISP connection provides.
- magila 9y ago
  With five upstream providers you're at the point where you really should have a proper router with it's own address block in front of your network. To put it bluntly, people like you are the reason why the IETF resisted standardizing any form of NAT for IPv6. They know that if there's a half-assed solution to a problem which makes the immediate pain go away but imposes negative externalities on the network as a whole, lots of people are going to take it.
  - gerdesj 9y ago
    I actually have two routers with CARP (Dell R320s with 10 NICs) but I don't have an unlimited budget. That is where the real problem lies: the cost of PI. However PI implies an additional internet routing entry (BGP) and of course that implies routing fragmentation. One of the goals of IPv6 was routing simplicity. To reply, rather bluntly to people like you, I am a sysadmin and a business owner who does not have an unlimited budget. I almost certainly have more experience with IPv6 than you, judging by your remarks. I am not combative by nature but please tell me what is the most effective way in your opinion of making best use of IPv6 with multiple links to the internet.
    - magila 9y ago
      If you think PI is too expensive, that is an issue between you and your service providers. As a developer of network applications, I have no interest in subsidizing your network management by going through the trouble of supporting NAT or NPTv6. Yes, if everyone used PI it would bloat the routing table, but the vast majority of businesses have no good reason to use PI. Having five providers makes you a special case, one where PI is clearly justified.
      - yardstick 9y ago
        What about a small business with Fibre, and a cellular backup? Both IPv6. How do I ensure my PCs only use the Fibre link until its not working, and only then use Cellular? Right now that just works out of the box with IPv4 and NAT. IPv6 also makes it difficult to plug and play new devices and install new networks. Example: The business needs to separate their Office PCs and their payment terminals (PCI DSS). Easiest way is to plug a firewall behind the existing LAN, and hang the terminals off the new firewall. You can't do that with IPv6 without the original router supporting DHCP6-PD, which it likely won't; or the ISP hasn't routed a large enough subnet to it to delegate smaller chunks. This is a mom and pop business that knows next to nothing about IT and shouldn't be penalised for that. In an ideal world where everyone has full knowledge of their systems and networks and can work with their providers to precisely accommodate their networking needs, IPv6 would work. I don't believe with the limited time, resources, and money we have that it is possible. Ultimately it's down to who caves in first. If the ideal solution requires £$€3000/yr more than another solution, and the other solution solves all the issues the business cares about, why would they spend the money to remove NAT?

by pc2g4d 9y ago

gerdesj 9y ago

Try putting in multiple internet connections each with its own IPv6 space! I have five at work but cannot really afford PI addressing (say £3000 per year) and certainly would not be able to get the four FTTC (VDSL) ISPs to route it. I also have a 100Mb leased line with yet another /56 prefix. That's five of the bloody things. Each PC/server/printer/whatever now has at least five globally unique IPv6 addresses. Now most of those devices also want to do various versions of each prefix - an algorithmic ally derived on based on MAC address, a randomish one (for privacy) etc. Add in link local and perhaps a few DHCPv6 addresses for good measure and it rapidly gets quite complicated. Now how does that lot get to and from the internet? For a PC to get to a web server it has to use the correct "local" address to get to the other end via the relevant ISP connection. However the PC can't know which internet connections are working without some form of routing protocol telling it what is going on upstream. So all my PCs, servers, printers and even IP cameras need to be routers rather than simply having a default gateway! As you can probably guess, that is not what I will actually do when I flick the IPv6 switch for real at work (home has been dual stack with one link for several years now). My current plan is ULA (a bit like IPv4 RFC 1918 - 192.168., 172.16. 10.) with Network Prefix Translation. That way my DNS servers, AD DCs (I think of those merely as KDCs but apparently they do other jobs) and other handy things wont renumber themselves every time a link goes down. The real joy of all this is I'll also get to manage two lots of firewall rules per VLAN. Can you imagine how busy a DNS server would get in the event of a flapping internet connection if it had to do dynamic DNS updates? Don't get hung up over NAT, the world of fully tooled up IPv6 is going to be far more "interesting", especially when you are not a big institution with a huge budget but want a bit more connectivity than one ISP connection provides.

magila 9y ago
With five upstream providers you're at the point where you really should have a proper router with it's own address block in front of your network. To put it bluntly, people like you are the reason why the IETF resisted standardizing any form of NAT for IPv6. They know that if there's a half-assed solution to a problem which makes the immediate pain go away but imposes negative externalities on the network as a whole, lots of people are going to take it.
- gerdesj 9y ago
  I actually have two routers with CARP (Dell R320s with 10 NICs) but I don't have an unlimited budget. That is where the real problem lies: the cost of PI. However PI implies an additional internet routing entry (BGP) and of course that implies routing fragmentation. One of the goals of IPv6 was routing simplicity. To reply, rather bluntly to people like you, I am a sysadmin and a business owner who does not have an unlimited budget. I almost certainly have more experience with IPv6 than you, judging by your remarks. I am not combative by nature but please tell me what is the most effective way in your opinion of making best use of IPv6 with multiple links to the internet.
  - magila 9y ago
    If you think PI is too expensive, that is an issue between you and your service providers. As a developer of network applications, I have no interest in subsidizing your network management by going through the trouble of supporting NAT or NPTv6. Yes, if everyone used PI it would bloat the routing table, but the vast majority of businesses have no good reason to use PI. Having five providers makes you a special case, one where PI is clearly justified.
    - yardstick 9y ago
      What about a small business with Fibre, and a cellular backup? Both IPv6. How do I ensure my PCs only use the Fibre link until its not working, and only then use Cellular? Right now that just works out of the box with IPv4 and NAT. IPv6 also makes it difficult to plug and play new devices and install new networks. Example: The business needs to separate their Office PCs and their payment terminals (PCI DSS). Easiest way is to plug a firewall behind the existing LAN, and hang the terminals off the new firewall. You can't do that with IPv6 without the original router supporting DHCP6-PD, which it likely won't; or the ISP hasn't routed a large enough subnet to it to delegate smaller chunks. This is a mom and pop business that knows next to nothing about IT and shouldn't be penalised for that. In an ideal world where everyone has full knowledge of their systems and networks and can work with their providers to precisely accommodate their networking needs, IPv6 would work. I don't believe with the limited time, resources, and money we have that it is possible. Ultimately it's down to who caves in first. If the ideal solution requires £$€3000/yr more than another solution, and the other solution solves all the issues the business cares about, why would they spend the money to remove NAT?